{"id":5617,"date":"2023-08-24T07:07:15","date_gmt":"2023-08-24T07:07:15","guid":{"rendered":"\/cybersecurity-blog\/?p=5617"},"modified":"2023-08-25T05:59:15","modified_gmt":"2023-08-25T05:59:15","slug":"xworm-technical-analysis-of-a-new-malware-version","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/","title":{"rendered":"XWorm: Technical Analysis of a New Malware Version\u00a0"},"content":{"rendered":"\n<p><\/p>\n\n\n\n<p>In this article, we will take a look at the latest version of an XWorm sample \u2014 a widespread malicious program that is advertised for sale on underground forums.&nbsp;<\/p>\n\n\n\n<p>We will analyze the functionality of our sample, as well as extract its configuration.&nbsp;<\/p>\n\n\n\n<p>Let\u2019s get started.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is XWorm Malware?&nbsp;<\/h2>\n\n\n\n<p>XWorm is a malware that targets Windows operating systems. It is known for its stealth and persistence, and a wide range of malicious activities, spanning from remote desktop control to ransomware and information theft.&nbsp;&nbsp;<\/p>\n\n\n\n<p>Unfortunately, adversaries employ this threat widely \u2014it\u2019s not uncommon to see it in <a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=xworm&amp;utm_content=landing\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a>\u2019s top 10 most used malware by uploads.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">TOP10 last week&#39;s threats by uploads ?<br>\u2b06\ufe0f <a href=\"https:\/\/twitter.com\/hashtag\/Redline?src=hash&amp;ref_src=twsrc%5Etfw\">#Redline<\/a> 219 (215)<br>\u2b06\ufe0f <a href=\"https:\/\/twitter.com\/hashtag\/Njrat?src=hash&amp;ref_src=twsrc%5Etfw\">#Njrat<\/a> 144 (84)<br>\u2b06\ufe0f <a href=\"https:\/\/twitter.com\/hashtag\/Agenttesla?src=hash&amp;ref_src=twsrc%5Etfw\">#Agenttesla<\/a> 112 (102)<br>\u2b06\ufe0f <a href=\"https:\/\/twitter.com\/hashtag\/Lumma?src=hash&amp;ref_src=twsrc%5Etfw\">#Lumma<\/a> 84 (65)<br>\u2b06\ufe0f <a href=\"https:\/\/twitter.com\/hashtag\/Asyncrat?src=hash&amp;ref_src=twsrc%5Etfw\">#Asyncrat<\/a> 84 (49)<br>\u2b06\ufe0f <a href=\"https:\/\/twitter.com\/hashtag\/Remcos?src=hash&amp;ref_src=twsrc%5Etfw\">#Remcos<\/a> 82 (58)<br>\u2b06\ufe0f <a href=\"https:\/\/twitter.com\/hashtag\/Amadey?src=hash&amp;ref_src=twsrc%5Etfw\">#Amadey<\/a> 80 (65)<br>\u2b07\ufe0f <a href=\"https:\/\/twitter.com\/hashtag\/Arkei?src=hash&amp;ref_src=twsrc%5Etfw\">#Arkei<\/a> 54 (57)<br>\u2b07\ufe0f <a href=\"https:\/\/twitter.com\/hashtag\/Xworm?src=hash&amp;ref_src=twsrc%5Etfw\">#Xworm<\/a> 43 (55)<br>\u2b07\ufe0f <a href=\"https:\/\/twitter.com\/hashtag\/Vidar?src=hash&amp;ref_src=twsrc%5Etfw\">#Vidar<\/a> 33 (35)<a href=\"https:\/\/t.co\/sSi7yan9BV\">https:\/\/t.co\/sSi7yan9BV<\/a> <a href=\"https:\/\/t.co\/0VNaiRojZh\">pic.twitter.com\/0VNaiRojZh<\/a><\/p>&mdash; ANY.RUN (@anyrun_app) <a href=\"https:\/\/twitter.com\/anyrun_app\/status\/1688422548533293056?ref_src=twsrc%5Etfw\">August 7, 2023<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">XWorm dynamic sandbox analysis&nbsp;<\/h2>\n\n\n\n<p>While searching for new threats, we discovered an <a href=\"https:\/\/app.any.run\/tasks\/d3858744-f1b2-4a9b-8ef7-deccada2a160\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=xworm&amp;utm_content=task\" target=\"_blank\" rel=\"noreferrer noopener\">interesting sample<\/a>, uploaded by our users to Public submissions. It was downloaded from the file hosting &#8220;Mediafire&#8221; in a RAR archive with a password:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-1024x576.jpeg\" alt=\"A sample with a RAR archive in ANY.RUN\" class=\"wp-image-5621\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-1024x576.jpeg 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-300x169.jpeg 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-768x432.jpeg 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-370x208.jpeg 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-270x152.jpeg 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-740x416.jpeg 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image.jpeg 1280w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>After launching, the threat was identified by Suricata&#8217;s network rules as XWorm:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"116\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-5-1024x116.png\" alt=\"XWorm is identified in ANY.RUN\" class=\"wp-image-5620\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-5-1024x116.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-5-300x34.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-5-768x87.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-5-370x42.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-5-270x31.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-5-740x84.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-5.png 1234w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>We decided to check the sample on VT to confirm that it was indeed XWorm, but at the time of writing this article, we were unable to find it there:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-medium\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"252\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-75-300x252.png\" alt=\"VT is missing Xworm sample\" class=\"wp-image-5648\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-75-300x252.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-75-370x311.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-75-270x227.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-75-740x622.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-75.png 752w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/figure>\n\n\n\n<p>The initial analysis, according to the indicators set on process 2784, revealed that the software adds its shortcut to the startup (<strong>MITRE T1547.001<\/strong>) and uses the task scheduler (<strong>MITRE T1053.005<\/strong>):&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"684\" height=\"338\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-4.png\" alt=\"The initial Xworm analysis\" class=\"wp-image-5623\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-4.png 684w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-4-300x148.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-4-370x183.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-4-270x133.png 270w\" sizes=\"(max-width: 684px) 100vw, 684px\" \/><\/figure>\n\n\n\n<p>The use of the scheduler is necessary to restart the software with elevated privileges, as indicated by the &#8220;\/RL HIGHEST&#8221; parameter.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"157\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-76-1024x157.png\" alt=\"Restart the software with elevated privilege\" class=\"wp-image-5649\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-76-1024x157.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-76-300x46.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-76-768x118.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-76-1536x236.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-76-370x57.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-76-270x42.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-76-740x114.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-76.png 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>According to the file operation data, the software is installed in the Public directory (<strong>MITRE T1074.001<\/strong>):&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"190\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-7.png\" alt=\"\" class=\"wp-image-5626\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-7.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-7-300x56.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-7-768x143.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-7-370x69.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-7-270x50.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-7-740x137.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Interestingly, the software attempts to connect to a remote server, but no response is received (<strong>MITRE T1571<\/strong>):&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"113\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-77-1024x113.png\" alt=\"Xworm attempts to connect to a remote server,\" class=\"wp-image-5650\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-77-1024x113.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-77-300x33.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-77-768x84.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-77-1536x169.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-77-370x41.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-77-270x30.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-77-740x81.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-77.png 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>We decided to <a href=\"https:\/\/app.any.run\/tasks\/912fb1a2-8205-4362-8965-82d62bce3406?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=xworm&amp;utm_content=task\" target=\"_blank\" rel=\"noreferrer noopener\">restart<\/a> the sample and check for additional activities. Unfortunately, it crashed almost immediately after launch:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"934\" height=\"412\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-8.png\" alt=\"Xworm restart crash\" class=\"wp-image-5628\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-8.png 934w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-8-300x132.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-8-768x339.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-8-370x163.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-8-270x119.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-8-740x326.png 740w\" sizes=\"(max-width: 934px) 100vw, 934px\" \/><\/figure>\n\n\n\n<p>We became interested in investigating the cause of the &#8220;crash,&#8221; and we found that the user-launched sample and the sample restarted by us exhibited different behavior patterns. Specifically, the restarted sample queries a service to determine the external IP address (<strong>MITRE T1590.005<\/strong>) before crashing. Typically, in addition to the IP address, such services provide the ability to determine whether the software is running on a virtual host:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"146\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-9-1024x146.png\" alt=\"\" class=\"wp-image-5629\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-9-1024x146.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-9-300x43.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-9-768x110.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-9-370x53.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-9-270x39.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-9-740x106.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-9.png 1440w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>This is precisely what XWorm does \u2014 it attempts to verify whether it&#8217;s running on a user&#8217;s physical machine or not.&nbsp;<\/p>\n\n\n\n<p>To solve this problem, <a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=xworm&amp;utm_content=landing\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a> has a useful feature called <strong>Residential Proxy<\/strong> which allows you to hide your actual location and convinces the software that it&#8217;s running on a real user&#8217;s machine. You can choose any location, in case it&#8217;s targeted malware requiring IP addresses from specific countries:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"842\" height=\"422\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-10.png\" alt=\"\" class=\"wp-image-5630\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-10.png 842w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-10-300x150.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-10-768x385.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-10-370x185.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-10-270x135.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-10-740x371.png 740w\" sizes=\"(max-width: 842px) 100vw, 842px\" \/><\/figure>\n\n\n\n<p><a href=\"https:\/\/app.any.run\/tasks\/a87a17c6-c76c-48f2-bb2b-b09e210db968?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=xworm&amp;utm_content=task\" target=\"_blank\" rel=\"noreferrer noopener\">Restarting<\/a> with the Residential Proxy option enabled was successful, and XWorm exhibited its activity. &nbsp;<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nSign up now and <span class=\"highlight\">run this task in ANY.RUN<\/span> with residential proxy \n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/app.any.run\/#register\" rel=\"noopener\" target=\"_blank\">\nCreate free account\u00a0\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<p><\/p>\n\n\n\n<p>Additionally, we activated the MITM proxy option to find out what data is being transmitted to Telegram (<strong>MITRE T1102<\/strong>):&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"511\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-11-1024x511.png\" alt=\"Xworm transmitts data to Telegram \" class=\"wp-image-5631\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-11-1024x511.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-11-300x150.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-11-768x383.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-11-370x185.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-11-270x135.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-11-740x369.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-11.png 1118w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>It&#8217;s evident that the software transmits its version (XWorm V3.1), the machine&#8217;s username, the operating system version, and likely a hash of a new victim (<strong>MITRE T1082<\/strong>).&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Xworm static analysis&nbsp;<\/h2>\n\n\n\n<p>The first step is to place our subject into the DIE \u2014 a utility for initial analysis.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"974\" height=\"354\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-12.png\" alt=\"Xworm analysis in DIE\" class=\"wp-image-5632\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-12.png 974w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-12-300x109.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-12-768x279.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-12-370x134.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-12-270x98.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-12-740x269.png 740w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/figure>\n\n\n\n<p>As we can see, we are dealing with a .NET variation, so we promptly opened it in dnSpy.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"974\" height=\"182\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-13.png\" alt=\"Xworm analysis in dnSpy\" class=\"wp-image-5633\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-13.png 974w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-13-300x56.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-13-768x144.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-13-370x69.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-13-270x50.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-13-740x138.png 740w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/figure>\n\n\n\n<p>We are immediately met with an unfavorable picture \u2014 all the program&#8217;s members were subjected to obfuscation (<strong>MITRE T1027<\/strong>). DIE could not recognize the packer even with the &#8220;Heuristic scan&#8221; being checked.&nbsp;<\/p>\n\n\n\n<p>Our first thought was to try using de4dot to simplify further analysis.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"781\" height=\"169\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-14.png\" alt=\"de4dot usage for further Xworm  analysis\" class=\"wp-image-5634\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-14.png 781w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-14-300x65.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-14-768x166.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-14-370x80.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-14-270x58.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-14-740x160.png 740w\" sizes=\"(max-width: 781px) 100vw, 781px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"974\" height=\"212\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-15.png\" alt=\" Xworm  analysis\" class=\"wp-image-5635\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-15.png 974w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-15-300x65.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-15-768x167.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-15-370x81.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-15-270x59.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-15-740x161.png 740w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/figure>\n\n\n\n<p>As we can see, not much has changed, so we must continue analyzing what we have.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Reverse engineering: additional anti-evasion techniques and persistence gain&nbsp;<\/h2>\n\n\n\n<p>To slow down the analysis and hide from detection systems, the sample employs the following technologies:&nbsp;<\/p>\n\n\n\n<p>1. Virtualization detection using the WMI query &#8220;Select * from Win32_ComputerSystem&#8221; and checking for operation within VmWare or VirtualBox environments (<strong>MITRE T1047<\/strong>)&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"319\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-16-1024x319.png\" alt=\"Detection of a virtual machine\u00a0\" class=\"wp-image-5636\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-16-1024x319.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-16-300x94.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-16-768x239.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-16-370x115.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-16-270x84.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-16-740x231.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-16.png 1357w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>2. Debugger detection using the CheckRemoteDebuggerPresent API function&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"243\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-17-1024x243.png\" alt=\"Detection of the debugger using CheckRemoteDebuggerPresent \" class=\"wp-image-5637\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-17-1024x243.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-17-300x71.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-17-768x183.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-17-370x88.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-17-270x64.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-17-740x176.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-17.png 1081w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>3. Checking for the loaded dynamic library SbieDll.dll, characteristic of Sandboxie, which is a sandbox-based isolation program.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1003\" height=\"175\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-18.png\" alt=\"Detection of Sandboxie \" class=\"wp-image-5638\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-18.png 1003w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-18-300x52.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-18-768x134.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-18-370x65.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-18-270x47.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-18-740x129.png 740w\" sizes=\"(max-width: 1003px) 100vw, 1003px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>4. A query to check whether the current machine is hosted or located in a data center (this finally clarifies why the sample initially &#8220;crashed&#8221;)&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"778\" height=\"201\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-19.png\" alt=\"Detection of hosting \" class=\"wp-image-5639\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-19.png 778w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-19-300x78.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-19-768x198.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-19-370x96.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-19-270x70.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-19-740x191.png 740w\" sizes=\"(max-width: 778px) 100vw, 778px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>The sample also gains a foothold by utilizing the registry and the task scheduler:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"537\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-20-1024x537.png\" alt=\"Xworm utilizes the registry and the task scheduler\" class=\"wp-image-5640\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-20-1024x537.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-20-300x157.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-20-768x403.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-20-370x194.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-20-270x142.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-20-740x388.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-20.png 1263w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Reverse engineering: Xworm config extraction&nbsp;<\/h2>\n\n\n\n<p>After a brief review of the methods&#8217; contents, a constructor was found that bears a striking resemblance to a block containing settings.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"974\" height=\"383\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-21.png\" alt=\"Xworm contents\" class=\"wp-image-5641\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-21.png 974w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-21-300x118.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-21-768x302.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-21-370x145.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-21-270x106.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-21-740x291.png 740w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/figure>\n\n\n\n<p>After examining cross-references, we arrive at a method that looks like this:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"974\" height=\"396\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-22.png\" alt=\"Xworm reverse-engineering\" class=\"wp-image-5642\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-22.png 974w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-22-300x122.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-22-768x312.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-22-370x150.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-22-270x110.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-22-740x301.png 740w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/figure>\n\n\n\n<p>As we can see, some fields undergo a reassignment stage, after processing by the method &#8220;Vc1fSJ4D04O6qGeP2fzA5lFCv8a7buXvJb4sHwuhuifI09pX.&#8221; Let&#8217;s take a closer look at it.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"974\" height=\"386\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-23.png\" alt=\"Xworm reverse-engineering\" class=\"wp-image-5643\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-23.png 974w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-23-300x119.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-23-768x304.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-23-370x147.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-23-270x107.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-23-740x293.png 740w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/figure>\n\n\n\n<p>First, an MD5 hash is computed from the value of the field &#8220;hArf0quX6jL4F88ywQTiLn52eBzsJ6HreaOqb0WGSa89u&#8221; from the presumed settings section. &nbsp;<\/p>\n\n\n\n<p>Then the obtained value is copied twice into a temporary array (perhaps the malware developer made an off-by-one error when using the Array.Copy method, resulting in the MD5 not being copied entirely twice; the last copied byte after the first copying is overwritten by the subsequent copying, so that the last byte in the resulting array is always zero). The obtained array is used as a key to decrypt the incoming base64 strings using AES in ECB mode.&nbsp;<\/p>\n\n\n\n<p>It&#8217;s also interesting that the field used is also a mutex.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"974\" height=\"135\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-24.png\" alt=\"Xworm mutex\" class=\"wp-image-5644\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-24.png 974w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-24-300x42.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-24-768x106.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-24-370x51.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-24-270x37.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-24-740x103.png 740w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/figure>\n\n\n\n<p>Now we have all the necessary information for decrypting the settings.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"978\" height=\"251\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-78.png\" alt=\"Xworm reverse-engineering\" class=\"wp-image-5651\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-78.png 978w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-78-300x77.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-78-768x197.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-78-370x95.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-78-270x69.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-78-740x190.png 740w\" sizes=\"(max-width: 978px) 100vw, 978px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Our final AES key looks like this: &#8220;01d31d5e811fce422987107f962c4001d31d5e811fce422987107f962c406600.&#8221;&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"315\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-79-1024x315.png\" alt=\"Xworm reverse-engineering\" class=\"wp-image-5652\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-79-1024x315.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-79-300x92.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-79-768x236.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-79-370x114.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-79-270x83.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-79-740x228.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/MicrosoftTeams-image-79.png 1235w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>And here we have reached the core of our target&#8217;s sample.&nbsp;<\/p>\n\n\n\n<p>The result can be viewed in CyberChef <a href=\"https:\/\/gchq.github.io\/CyberChef\/#recipe=From_Base64('A-Za-z0-9%2B\/%3D',true,false)AES_Decrypt(%7B'option':'Hex','string':'01d31d5e811fce422987107f962c4001d31d5e811fce422987107f962c406600'%7D,%7B'option':'Hex','string':''%7D,'ECB','Raw','Raw',%7B'option':'Hex','string':''%7D,%7B'option':'Hex','string':''%7D)&amp;input=V0kyVXdYSW05MkdhSnBIR2NwK2YxMHFhZ29SN2F5TW15L2poV2s1OHk5TT0KOEY1QzVKVmNFdnEyMUtWcWlBdnhnUT09CmtjQUsrUmlxUDdwOUVLSkJGT2RveVhFTkNpSjBnWkd6Wm52NXMxTmJac0E9CjRyK2NQMFpJL29aclkxakNtbFRWVUE9PQpkS3c4bWh0QjhJZUZnWE5wdVVVZDZnPT0KOThaTWUyY1dRTjZ2alN5aVhmazIyLzNtU1pBaW04U05EdmZEYkttVG43ckJKRjhhN1ZZODhLa3hFNWltcThReAppaGUyN1pKWnpRNWNETWVBV2lBcURnPT0\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a>.&nbsp;<\/p>\n\n\n\n<p><strong>The final config mapping is as follows:&nbsp;<\/strong><\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-13\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"10\"\n           data-wpID=\"13\"\n           data-responsive=\"0\"\n           data-has-header=\"0\">\n\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:35.422343324251%;                    padding:10px;\n                    \"\n                    >\n                                        Host\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:64.577656675749%;                    padding:10px;\n                    \"\n                    >\n                                        6[.]tcp.eu.ngrok[.]io\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Port\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        13394\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        AES key\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Slaves!-.;!2Swezy999!(xxx\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Splitter\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Xwormmm                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Sleep time\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        3\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        USB drop file\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        USB.exe\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"A7\"\n                    data-col-index=\"0\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Mutex\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"B7\"\n                    data-col-index=\"1\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Lz8qftMH08V7f1rq\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"A8\"\n                    data-col-index=\"0\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Log file\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"B8\"\n                    data-col-index=\"1\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        %temp%\\\\Log.tmp\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"A9\"\n                    data-col-index=\"0\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Telegram token\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B9\"\n                    data-col-index=\"1\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        6674821695:AAExQsr6_hmXk6hz7CN4kMSi9cs9y86daYM\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"A10\"\n                    data-col-index=\"0\"\n                    data-row-index=\"9\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Telegram chat id\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-wrap-text\"\n                                            data-cell-id=\"B10\"\n                    data-col-index=\"1\"\n                    data-row-index=\"9\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        5865520781\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-13'>\n<\/style>\n\n\n\n\n<p>When the goal isn&#8217;t to study the malware in-depth but rather to quickly obtain the configuration, this can be efficiently achieved by running the sample in ANY.RUN. This method provides a straightforward way to access the necessary information without the need for extensive analysis, saving potentially hours of work.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"979\" height=\"660\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-25.png\" alt=\"Xworm malware configuration in ANY.RUN\" class=\"wp-image-5646\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-25.png 979w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-25-300x202.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-25-768x518.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-25-370x249.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-25-270x182.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-25-740x499.png 740w\" sizes=\"(max-width: 979px) 100vw, 979px\" \/><\/figure>\n\n\n\n<p>See it in action for yourself <a href=\"https:\/\/app.any.run\/tasks\/6b39d7fd-6326-430e-92da-9556920304ea?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=xworm&amp;utm_content=task\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a>.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">IOCs&nbsp;<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Analyzed files<\/h3>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-14\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"4\"\n           data-wpID=\"14\"\n           data-responsive=\"0\"\n           data-has-header=\"0\">\n\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:17.711598746082%;                    padding:10px;\n                    \"\n                    >\n                                        MD5\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:82.288401253918%;                    padding:10px;\n                    \"\n                    >\n                                        F6BB396FD836F66CD9F33CA4B0262DD7\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        SHA1\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        BFC7036E32A59AC25DB505D263B5F4CADE24C53C\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        SHA256\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        1073FF4689CB536805D2881988B72853B029040F446AF5CED18D1BC08B2266E1\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        SS\u00a0\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        6144:bfIbSc83qUhcX7elbKTua9bfF\/H9d9n+:bLc83q3X3u+G\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-14'>\n<\/style>\n\n\n\n\n<h3 class=\"wp-block-heading\">MITRE (ARMATTACK)<\/h3>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-15\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"3\"\n           data-rows=\"11\"\n           data-wpID=\"15\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell wpdt-wrap-text wpdt-align-left\"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        Tactic\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell wpdt-wrap-text wpdt-align-left\"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        Technique\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell wpdt-wrap-text wpdt-align-left\"\n                                            data-cell-id=\"C1\"\n                    data-col-index=\"2\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        Description\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        TA0003: Persistence\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1547: Registry Run Keys \/ Startup Folder\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"C2\"\n                    data-col-index=\"2\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Adds a shortcut to the startup folder\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        TA0003: Persistence\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1053: Scheduled Task\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"C3\"\n                    data-col-index=\"2\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Uses the task scheduler\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        TA0009: Collection\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1074: Local Data Staging\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"C4\"\n                    data-col-index=\"2\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        The malware saves itself in the Public directory\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        TA0011: Command and Control\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1571: Non-Standard Port\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"C5\"\n                    data-col-index=\"2\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Connects to a remote server\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        TA0043: Reconnaissance\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1590: IP Addresses\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"C6\"\n                    data-col-index=\"2\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Checks the IP of the running system\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"A7\"\n                    data-col-index=\"0\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        TA0011: Command and Control\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"B7\"\n                    data-col-index=\"1\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1102: Bidirectional Communication\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"C7\"\n                    data-col-index=\"2\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Communicates through Telegram\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"A8\"\n                    data-col-index=\"0\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        TA0007: Discovery\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"B8\"\n                    data-col-index=\"1\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1082: System Information Discovery\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"C8\"\n                    data-col-index=\"2\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Collects information about the victim's computer\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"A9\"\n                    data-col-index=\"0\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        TA0005: Defense Evasion\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"B9\"\n                    data-col-index=\"1\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1027: Command Obfuscation\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"C9\"\n                    data-col-index=\"2\"\n                    data-row-index=\"8\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Obfuscates the executable file\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"A10\"\n                    data-col-index=\"0\"\n                    data-row-index=\"9\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        TA0002: Execution\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"B10\"\n                    data-col-index=\"1\"\n                    data-row-index=\"9\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1047: Windows Management Instrumentation\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"C10\"\n                    data-col-index=\"2\"\n                    data-row-index=\"9\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Gathers system information to detect virtualization\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"A11\"\n                    data-col-index=\"0\"\n                    data-row-index=\"10\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        TA0005: Defense Evasion\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"B11\"\n                    data-col-index=\"1\"\n                    data-row-index=\"10\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        T1027: Embedded Payloads\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left wpdt-wrap-text\"\n                                            data-cell-id=\"C11\"\n                    data-col-index=\"2\"\n                    data-row-index=\"10\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Stores information in a mutex\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-15'>\ntable#wpdtSimpleTable-15{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-15 td, table.wpdtSimpleTable15 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<h3 class=\"wp-block-heading\">DNS requests&nbsp;<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>6[.]tcp[.]eu[.]ngrok[.]io&nbsp;<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">More samples for your research<\/h2>\n\n\n\n<p><a href=\"https:\/\/app.any.run\/tasks\/d3858744-f1b2-4a9b-8ef7-deccada2a160\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=xworm&amp;utm_content=task\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/app.any.run\/tasks\/d3858744-f1b2-4a9b-8ef7-deccada2a160\/<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/app.any.run\/tasks\/75f66fd6-d989-4f06-a348-c65e135e8ab4\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=xworm&amp;utm_content=task\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/app.any.run\/tasks\/75f66fd6-d989-4f06-a348-c65e135e8ab4\/<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/app.any.run\/tasks\/5fab7db5-267e-46f6-a374-0f42de1cb328\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=xworm&amp;utm_content=task\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/app.any.run\/tasks\/5fab7db5-267e-46f6-a374-0f42de1cb328\/<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/app.any.run\/tasks\/b9275944-39fe-42cb-9eae-6b2e05f0892f\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=xworm&amp;utm_content=task\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/app.any.run\/tasks\/b9275944-39fe-42cb-9eae-6b2e05f0892f\/<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/app.any.run\/tasks\/803758bf-387b-42e2-80cc-f20e7140cac4\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=xworm&amp;utm_content=task\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/app.any.run\/tasks\/803758bf-387b-42e2-80cc-f20e7140cac4\/<\/a><\/p>\n\n\n\n<div style=\"height:38px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>Interested in more content like this? Check out our <a href=\"https:\/\/any.run\/cybersecurity-blog\/analyzing-laplasclipper-malware\/\" target=\"_blank\" rel=\"noreferrer noopener\">in-depth analysis of the latest .NET variant of LaplasClipper<\/a> or read a break-down and <a href=\"https:\/\/any.run\/cybersecurity-blog\/deobfuscating-guloader\/\" target=\"_blank\" rel=\"noreferrer noopener\">guide to GuLoader deobfuscation<\/a> strategies.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A few words about ANY.RUN&nbsp;<\/h2>\n\n\n\n<p>ANY.RUN is a cloud malware sandbox that handles the heavy lifting of malware analysis for SOC and DFIR teams. Every day, 300,000 professionals use our platform to investigate incidents and streamline threat analysis.&nbsp;&nbsp;<\/p>\n\n\n\n<p>Request a demo today and enjoy 14 days of free access to our Enterprise plan.&nbsp;<\/p>\n\n\n\n<p><a href=\"https:\/\/any.run\/demo?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=xworm&amp;utm_content=trial\" target=\"_blank\" rel=\"noreferrer noopener\">Request demo \u2192<\/a>&nbsp;<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this article, we will take a look at the latest version of an XWorm sample \u2014 a widespread malicious program that is advertised for sale on underground forums.&nbsp; We will analyze the functionality of our sample, as well as extract its configuration.&nbsp; Let\u2019s get started.&nbsp; What is XWorm Malware?&nbsp; XWorm is a malware that [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":5662,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[34,40],"class_list":["post-5617","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-malware-analysis","tag-malware-analysis","tag-malware-behavior"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.10 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>XWorm: Technical Analysis of a New Malware Version\u00a0<\/title>\n<meta name=\"description\" content=\"Today we\u2019re releasing new malware analysis from ANYRUN\u2019s team. Read how we decrypted the settings of a new version of XWorm.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Electron, kinoshi and glebyao\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/\"},\"author\":{\"name\":\"Electron, kinoshi and glebyao\",\"@id\":\"https:\/\/any.run\/\"},\"headline\":\"XWorm: Technical Analysis of a New Malware Version\u00a0\",\"datePublished\":\"2023-08-24T07:07:15+00:00\",\"dateModified\":\"2023-08-25T05:59:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/\"},\"wordCount\":1263,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"keywords\":[\"malware analysis\",\"malware behavior\"],\"articleSection\":[\"Malware Analysis\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/\",\"name\":\"XWorm: Technical Analysis of a New Malware Version\u00a0\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/\"},\"datePublished\":\"2023-08-24T07:07:15+00:00\",\"dateModified\":\"2023-08-25T05:59:15+00:00\",\"description\":\"Today we\u2019re releasing new malware analysis from ANYRUN\u2019s team. Read how we decrypted the settings of a new version of XWorm.\",\"breadcrumb\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Malware Analysis\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/category\/malware-analysis\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"XWorm: Technical Analysis of a New Malware Version\u00a0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/any.run\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\/\/any.run\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\/\/any.run\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/www.any.run\/\",\"https:\/\/twitter.com\/anyrun_app\",\"https:\/\/www.linkedin.com\/company\/30692044\",\"https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ\"]},[{\"@type\":[\"Person\"],\"@id\":\"https:\/\/any.run\/\",\"name\":\"Electron\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/any.run\/\",\"inLanguage\":\"en_US\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/05\/6394744-150x150.png\",\"caption\":\"Electron\"}},{\"@type\":[\"Person\"],\"@id\":\"https:\/\/any.run\/\",\"name\":\"kinoshi\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/any.run\/\",\"inLanguage\":\"en_US\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/06\/MicrosoftTeams-image-48-150x150.jpg\",\"caption\":\"kinoshi\"}},{\"@type\":[\"Person\"],\"@id\":\"https:\/\/any.run\/\",\"name\":\"glebyao\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/any.run\/\",\"inLanguage\":\"en_US\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/glebyao-150x150.jpg\",\"caption\":\"glebyao\"}}]]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"XWorm: Technical Analysis of a New Malware Version\u00a0","description":"Today we\u2019re releasing new malware analysis from ANYRUN\u2019s team. Read how we decrypted the settings of a new version of XWorm.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/","twitter_misc":{"Written by":"Electron, kinoshi and glebyao","Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/"},"author":{"name":"Electron, kinoshi and glebyao","@id":"https:\/\/any.run\/"},"headline":"XWorm: Technical Analysis of a New Malware Version\u00a0","datePublished":"2023-08-24T07:07:15+00:00","dateModified":"2023-08-25T05:59:15+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/"},"wordCount":1263,"commentCount":0,"publisher":{"@id":"https:\/\/any.run\/"},"keywords":["malware analysis","malware behavior"],"articleSection":["Malware Analysis"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/","url":"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/","name":"XWorm: Technical Analysis of a New Malware Version\u00a0","isPartOf":{"@id":"https:\/\/any.run\/"},"datePublished":"2023-08-24T07:07:15+00:00","dateModified":"2023-08-25T05:59:15+00:00","description":"Today we\u2019re releasing new malware analysis from ANYRUN\u2019s team. Read how we decrypted the settings of a new version of XWorm.","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/xworm-technical-analysis-of-a-new-malware-version\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Malware Analysis","item":"https:\/\/any.run\/cybersecurity-blog\/category\/malware-analysis\/"},{"@type":"ListItem","position":3,"name":"XWorm: Technical Analysis of a New Malware Version\u00a0"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/twitter.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},[{"@type":["Person"],"@id":"https:\/\/any.run\/","name":"Electron","image":{"@type":"ImageObject","@id":"https:\/\/any.run\/","inLanguage":"en_US","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/05\/6394744-150x150.png","caption":"Electron"}},{"@type":["Person"],"@id":"https:\/\/any.run\/","name":"kinoshi","image":{"@type":"ImageObject","@id":"https:\/\/any.run\/","inLanguage":"en_US","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/06\/MicrosoftTeams-image-48-150x150.jpg","caption":"kinoshi"}},{"@type":["Person"],"@id":"https:\/\/any.run\/","name":"glebyao","image":{"@type":"ImageObject","@id":"https:\/\/any.run\/","inLanguage":"en_US","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/glebyao-150x150.jpg","caption":"glebyao"}}]]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/5617"}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=5617"}],"version-history":[{"count":7,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/5617\/revisions"}],"predecessor-version":[{"id":5664,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/5617\/revisions\/5664"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/5662"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=5617"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=5617"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=5617"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}